
Research
Malicious NuGet Packages Typosquat Nethereum to Exfiltrate Wallet Keys
The Socket Threat Research Team uncovered malicious NuGet packages typosquatting the popular Nethereum project to steal wallet keys.
@equinor/amplify-component-lib
Advanced tools
This package contains components, utils, providers and hooks developed and used by the amplify team.
Build and publish is done automatically when code is merged into main
branch, if the package.json version number is higher.
To increase the version number use npm run version <type>
and specify what type of versioning.
Navigate to your projects root folder, ~/Projects/recap
for instance
Copy and run the following command
wget -q -O - https://raw.githubusercontent.com/equinor/amplify-component-lib/main/config/install.sh | bash
This should have downloaded the .eslintrc.cjs
, .prettierignore
, .prettierrc.jr
, tsconfig.json
, env.sh
, Dockerfile
, proxy/nginx.conf
, proxy/securityheaders.conf
and github actions workflow files
Navigate to your projects root folder, ~/Projects/recap
for instance
Copy and run the following command
wget -q -O - https://raw.githubusercontent.com/equinor/amplify-component-lib/main/config/install-deployment-files.sh | bash
This should have downloaded the build_deploy_radix.yaml
, promote.yaml
, notify.yaml
, push.yaml
NOTE: These files should eventually be served from the same install script we use for getting other config files. We serve it from a different script so that applications which are not ready for the change in deployment process don't have to rush.
This script assumes the following structure in the project
project
│ README.md
│
└───client
│ | ...
│
└───server
│ ...
Navigate to your projects root folder, ~/Projects/recap
for instance
Copy and run the following command
wget -q -O - https://raw.githubusercontent.com/equinor/amplify-component-lib/main/config/precommit/install.sh | bash
This should have downloaded a package.json
file in the root of the project, created (if it didn't exist) the tooling
folder.
You should also see a .husky
folder in the root of the project with a file called pre-commit
inside
We use hadolint to check that our docker file is using best practice.
In order to commit changes related to a dockerfile you need to have hadolint installed
On OSX you can use brew to install:
brew install hadolint
On Windows you can use scoop to install:
scoop install hadolint
In any of these do not work then you can refer to the installation section in hadolint's repository
If you want to shorten the feedback loop when changing your dockerfile you can optionally add the hadolint extension (Extension id: exiasr.hadolint
)
Looks like it is not available for WebStorm at the moment
FAQs
Frontend Typescript components for the Amplify team
The npm package @equinor/amplify-component-lib receives a total of 1,845 weekly downloads. As such, @equinor/amplify-component-lib popularity was classified as popular.
We found that @equinor/amplify-component-lib demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
The Socket Threat Research Team uncovered malicious NuGet packages typosquatting the popular Nethereum project to steal wallet keys.
Product
A single platform for static analysis, secrets detection, container scanning, and CVE checks—built on trusted open source tools, ready to run out of the box.
Product
Socket is launching experimental protection for the Hugging Face ecosystem, scanning for malware and malicious payload injections inside model files to prevent silent AI supply chain attacks.